Description

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device nodes but may lead to access heap memory behind perms->adm when an administrative CPRB is sent. Add correct limit (AP_DOMAINS = 256) checking to fix this.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-28T08:16:56.523Z",
  "pubdate": "2026-08-28T08:16:56.523Z",
  "executiveSummary": "A memory safety vulnerability exists in the Linux kernel s390 zcrypt subsystem related to EP11 CPRB (Cryptographic Parameter Request Block) processing. The vulnerability is categorized as an out-of-bounds memory access due to improper input validation of the domain value. An attacker with access to custom zcrypt device nodes can trigger this flaw by submitting a malformed administrative CPRB. The vulnerability resides in the domain verification logic, which fails to correctly enforce the maximum limit defined by AP_DOMAINS (256). Successful exploitation allows an attacker to access heap memory beyond the intended perms->adm structure boundary. This can result in unauthorized memory disclosure or potentially lead to system instability and kernel-level memory corruption. The risk is constrained to local users with permissions to access zcrypt device nodes, necessitating a restricted-access environment for mitigation.",
  "technicalDetails": "The vulnerability is located within the s390 zcrypt kernel subsystem, specifically in the logic responsible for validating the domain index when processing EP11 CPRBs. The zcrypt architecture utilizes AP (Adjunct Processor) devices, and the EP11 (Enterprise PKCS #11) support facilitates secure cryptographic operations. The kernel module maintains a permissions structure for administrative tasks, including a field representing the domain index.\nThe root cause is an incorrect upper-limit check on the domain value during the processing of administrative EP11 CPRBs. When a user-space application issues an ioctl or write request to a custom zcrypt device node, the kernel performs validation on the provided domain. The existing implementation fails to correctly validate the input against the maximum allowed value defined by the constant AP_DOMAINS (256).\nUnder normal operations, the domain index should be strictly constrained. However, due to the flawed validation, a malicious or malformed administrative CPRB can bypass the intended bounds check. This causes the kernel to treat an out-of-bounds integer as a valid index when accessing the perms->adm memory structure. Consequently, the kernel performs read or write operations on adjacent heap memory segments located beyond the end of the intended structure.\nThe exploitation flow proceeds as follows: First, an attacker with sufficient permissions to open the relevant device node (typically /dev/zcrypt or a specific adapter node) crafts a custom EP11 CPRB packet. Second, the attacker embeds a domain index value that exceeds 255 but is interpreted as valid by the flawed check. Third, the driver processes the CPRB and utilizes this index to reference the internal perms->adm structure. Finally, the kernel inadvertently performs operations on unintended heap memory locations adjacent to the legitimate structure. This mechanism can lead to the exposure of sensitive kernel memory contents or arbitrary memory corruption, depending on the nature of the subsequent operations performed with the pointer derived from the out-of-bounds index. Since this occurs within kernel space, the attacker gains the ability to interact with memory outside their authorized context without requiring specific hardware-level privileges, provided they can successfully reach the administrative path of the EP11 command processing."
}